Responsible for Implementation: DATA PROTECTION OFFICER
Latest Review Date: October 2023
Next Review Date: October 2024
Authorised By: CHIEF FINANCIAL OFFICER
Access Further Education Ltd (‘The College’) has subsidiary companies, trading names and trading partnerships through which it operates. The trading names and partnerships might have their own names or brands, but the legalentity for the purpose of this policy is Access Further Education Ltd. Trading subsidiaries, trading names and trading partnerships include Access Creative College (‘ACC’), National College for Creative Industries (‘NCCI’) and AccessSport. The dBs Institute (DBS Music UK Holdings and its subsidiaries), whilst a separate legal entity, shares common Directorships with the College, however, responsibility for Data Protection related Policies within dBs falls to the DPOfor Access Further Education Ltd.
About This Policy
This Privacy Notice is intended to provide information on how we handle the personal data of prospective learners and employees, visitors to our website and those who contact us about our services. We have separate PrivacyNotices available for our employees, and our current learners and alumni.
We use this information to improve our website and ensure its functionality.
Lawful basis: Consent
When you complete one of our website forms, submit an enquiry, or book to attend an event, we collect the following information:
We use this information to contact you regarding your interest in the college, to plan your attendance at events, and to send you promotional emails about new events or other information from the College that we think may be of interest. We will retain your information for 6 years following the end of the event before deletion.
Lawful basis: Legitimate Interest
When you apply to study with us, we will collect the following from you in our application forms:
We use this information to:
If you enrol as a learner with the College, we will collect further information from you. You can find out more about what this data is, and what we do with it, from our Learner Privacy Notice, which will be made available to you alongside your enrolment form. You may request a copy of this at any time.
If your application is unsuccessful, your data will be retained for 2 years following the end of the relevant academic year before deletion.
Lawful basis: contractual (necessary for the performance of a contract - our provision of education/training)
When you apply for a role with us you are taken to our vacancy portal, hosted by Hireful. We collect the following information from you:
We will use this information to assess your suitability for the role you have applied to, to invite you for an interview, or to request more information. If you are unsuccessful, your data will be retained for 6 months before deletion.
If you become a member of our workforce, then a separate Workforce Privacy Notice will be made available to you.
Lawful basis: contractual & compliance with legal obligations
We may collect, store and use information about criminal convictions and offences for course applications and We collect, store and use information about criminal convictions and offences for both course applications and employment applications. All employees are required to undergo either a Standard or Enhanced DBS check before employment commences. All potential learners are asked to disclose any criminal convictions/offences at the interview stage of their application.
Lawful basis: Compliance with legal obligations
If a prospective learner discloses information during the application and interview process which relates to potential safeguarding concerns, and would require additional review or risk management, the College will collect this information. Personal Data processed for safeguarding includes name, address, date of birth, contact details, health information, details of the nature of the safeguarding case and previous safeguarding information.
Safeguarding data is stored within our MyConcern account, and may be shared with external third parties, such as local authorities or the police, only where there is a legal requirement to do so. We are required to maintain records of safeguarding cases of children until the 25th birthday of the child.
The College uses external companies to process personal data on our behalf:
Processors used specifically for the data of fully enrolled learners and employees are listed within the respective Privacy Notices (available on request).
You have a number of rights over your personal data, and how we handle it. These are listed below.
The Right to be Informed:
We keep you informed through our Privacy Notices, and by uploading our relevant data protection policies to our websites.
Right to Access:
You have the right to access the personal information that we hold by making a ‘Subject Access Request’. If we agree that we are obliged to provide this to you (or to someone else on your behalf), we will provide it free of charge and aim to do so within 30 days, starting from the date that we confirm your identity.
Right to Rectification:
If any of the personal information we hold about you is inaccurate, incomplete or out of date, you may ask us to correct it.
Right to Stop or Limit Our Processing of Your Data:
You can ask us to stop or limit your data being processed under certain circumstances - where data is being used for direct marketing, or where we use the legal basis of legitimate interest and we do not have a compelling basis to continue this processing following an objection.
Right to Erasure:
This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.
Right to Portability:
You have the right to receive your personal data in a structured, commonly used and machine readable format, to allow you to pass this data easily to another controller. It also gives you the right to request that we transmit this data directly to another controller.
We meet the criteria set within the Data Protection Legislation to appoint a DPO (Data Protection Officer). They advise and inform the College about all aspects of data protection, and monitor our compliance with the legislation. They assist with risk assessments, staff training and awareness. The DPO is our designated point of contact for both you, our data subjects, and the ICO.
Their email address is: firstname.lastname@example.org
If you have any questions about this policy, or wish to complain about how your data is being processed, please contact us via one of the following methods:
By email: email@example.com
Access Creative College (Access Further Education Limited)
50 Fountain Street
If you are not happy with the way your information is being handled, or with a response we have provided to you regarding a complaint, you have the right to lodge a complaint with the Information Commissioner’s Office:
Wycliffe House, Water Lane, Wilmslow, SK9 5AF (https://ico.org.uk/)